0

I've found the esc_url() function and I'm trying to understand what to do with URLs in Wordpress, before resorting to my normal PHP tactics. I see that the third parameter is used to set the filter that runs on it, with the default value of 'display'. This is for display on a webpage. I grepped the WP source code for examples of the use of the third parameter and found but a single example:

$ grep -rP "esc_url.*\([^\)\,]*\,[^\)\,]*\, ?'?\"?.*\)" *
wp-includes/formatting.php: return esc_url( $url, $protocols, 'db' );

All other matches to grep were for irrelevant invocations, such as the use of another function call's return value as an esc_url() argument.

Other than 'display' and 'db', what other values should be used and when? I see quite a few places in the WP source code where the display value is used in an href, here is an example:

$ grep -r esc_url * | grep href
wp-admin/themes.php: <td><a href="<?php echo esc_url( $delete_url ); ?>" class="button button-secondary delete-theme"><?php _e( 'Delete' ); ?></a></td>

Should the 'display' value really be used for an href attribute? It seems to me that it does some encoding that I would not trust to return always to proper URL afterward, especially for non-ASCII URLs.

Is this a bug in WP that the 'dispaly' filter is being used for actual URLs, or should I use the 'display' filter for actual URLs in my own code as well?

1

No other value can be used in place of display and db.

WordPress just check for value display and convert & and 'quotes to HTML entities (Including all other characters). If you pass db it is just skip this block of code. However, WordPress recommends to use esc_url_raw() instead of passing third argument.

You can use esc_url_raw() when saving back-end options like theme options or plugin settings and you should always esc_url() in href attribute, browser decodes it very well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.